Automating ACMEv2 Certificate Management on BIG-IP

As Kevin rightly pointed out, using the ACME protocol—particularly the http-01 challenge—for renewing the BIG-IP management certificate is not practical. 

While the dns-01 challenge offers a workaround (by validating ownership via DNS rather than HTTP), it still doesn’t directly solve the problem. Lot of devices does not have the hostname provided on the DNS server.

That said, there is a more suitable solution available:

A better and more secure alternative is to use a script-based approach that leverages the EST (Enrollment over Secure Transport) protocol. This method allows you to:

• Authenticate securely to your internal certificate authority.
• Request and retrieve new certificates over HTTPS.
• Automatically install the renewed certificate on the BIG-IP management interface.

This avoids public exposure and can be fully automated in environments where an internal PKI with EST support is available (e.g., Microsoft ADCS with EST proxy, EJBCA, etc.).

If you’re managing BIG-IP devices at scale or aiming for a hands-off certificate lifecycle, this approach is recommended.